Container Basics On Linux (Namespaces/Cgroups)

Stop letting stray processes escape your cgroup control

🧩 The Challenge

Sometimes I kill a container but notice a handful of orphaned background workers still hogging CPU on the host. It drives me up the wall because they aren’t visible in the container’s namespace anymore, and I have to hunt them down manually.

💡 The Fix

You need to enable the Memory Controller’s process group kill feature, which ensures the kernel nukes everything in the cgroup tree the moment the primary process exits. It’s the only way to guarantee a clean slate without playing whack-a-mole with PIDs.

echo 1 > /sys/fs/cgroup/system.slice/your-container.service/cgroup.kill

⚙️ Why It Works

Setting this flag tells the kernel to automatically send a SIGKILL to all remaining processes inside the specific cgroup hierarchy once the leader dies. It turns the cgroup into a reliable cleanup mechanism rather than just a resource tracker.

🚀 Pro-Tip: Check /sys/fs/cgroup/cgroup.controllers to see if your system supports these settings before you start tearing your hair out.

Linux Tips & Tricks | © ngelinux.com | 8/20/2026